CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Linux » Linux Kernel : Security Vulnerabilities (CVSS score between 7 and 7.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
351 CVE-2006-4997 DoS 2006-10-10 2010-09-15
7.1
None Remote Medium Not required None None Complete
The clip_mkip function in net/atm/clip.c of the ATM subsystem in Linux kernel allows remote attackers to cause a denial of service (panic) via unknown vectors that cause the ATM subsystem to access the memory of socket buffers after they are freed (freed pointer dereference).
352 CVE-2006-4623 DoS 2006-09-11 2010-09-15
7.8
None Remote Low Not required None None Complete
The Unidirectional Lightweight Encapsulation (ULE) decapsulation component in dvb-core/dvb_net.c in the dvb driver in the Linux kernel 2.6.17.8 allows remote attackers to cause a denial of service (crash) via an SNDU length of 0 in a ULE packet.
353 CVE-2006-4572 264 Bypass 2006-11-06 2012-03-19
7.5
User Remote Low Not required Partial Partial Partial
ip6_tables in netfilter in the Linux kernel before 2.6.16.31 allows remote attackers to (1) bypass a rule that disallows a protocol, via a packet with the protocol header not located immediately after the fragment header, aka "ip6_tables protocol bypass bug;" and (2) bypass a rule that looks for a certain extension header, via a packet with an extension header outside the first fragment, aka "ip6_tables extension header bypass bug."
354 CVE-2006-3745 DoS +Priv 2006-08-23 2012-03-19
7.2
Admin Local Low Not required Complete Complete Complete
Unspecified vulnerability in the sctp_make_abort_user function in the SCTP implementation in Linux 2.6.x before 2.6.17.10 and 2.4.23 up to 2.4.33 allows local users to cause a denial of service (panic) and possibly gain root privileges via unknown attack vectors.
355 CVE-2006-3468 DoS 2006-07-21 2010-08-21
7.8
None Remote Low Not required None None Complete
Linux kernel 2.6.x, when using both NFS and EXT3, allows remote attackers to cause a denial of service (file system panic) via a crafted UDP packet with a V2 lookup procedure that specifies a bad file handle (inode number), which triggers an error and causes an exported directory to be remounted read-only.
356 CVE-2006-3085 DoS 2006-06-23 2010-09-15
7.8
None Remote Low Not required None None Complete
xt_sctp in netfilter for Linux kernel before 2.6.17.1 allows attackers to cause a denial of service (infinite loop) via an SCTP chunk with a 0 length.
357 CVE-2006-2936 399 DoS 2006-07-10 2012-03-19
7.8
None Remote Low Not required None None Complete
The ftdi_sio driver (usb/serial/ftdi_sio.c) in Linux kernel 2.6.x up to 2.6.17, and possibly later versions, allows local users to cause a denial of service (memory consumption) by writing more data to the serial port than the hardware can handle, which causes the data to be queued.
358 CVE-2006-2444 DoS 2006-05-25 2010-08-21
7.8
None Remote Low Not required None None Complete
The snmp_trap_decode function in the SNMP NAT helper for Linux kernel before 2.6.16.18 allows remote attackers to cause a denial of service (crash) via unspecified remote attack vectors that cause failures in snmp_trap_decode that trigger (1) frees of random memory or (2) frees of previously-freed memory (double-free) by snmp_trap_decode as well as its calling function, as demonstrated via certain test cases of the PROTOS SNMP test suite.
359 CVE-2006-1858 20 DoS Exec Code 2006-05-22 2010-08-21
7.8
None Remote Low Not required None None Complete
SCTP in Linux kernel before 2.6.16.17 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a chunk length that is inconsistent with the actual length of provided parameters.
360 CVE-2006-1856 Bypass 2006-05-19 2010-08-21
7.5
User Remote Low Not required Partial Partial Partial
Certain modifications to the Linux kernel 2.6.16 and earlier do not add the appropriate Linux Security Modules (LSM) file_permission hooks to the (1) readv and (2) writev functions, which might allow attackers to bypass intended access restrictions.
361 CVE-2006-1624 DoS 2006-04-05 2008-09-05
7.8
None Remote Low Not required None None Complete
The default configuration of syslogd in the Linux sysklogd package does not enable the -x (disable name lookups) option, which allows remote attackers to cause a denial of service (traffic amplification) via messages with spoofed source IP addresses.
362 CVE-2006-0457 DoS 2006-03-13 2010-08-21
7.1
None Remote High Not required Complete None Complete
Race condition in the (1) add_key, (2) request_key, and (3) keyctl functions in Linux kernel 2.6.x allows local users to cause a denial of service (crash) or read sensitive kernel memory by modifying the length of a string argument between the time that the kernel calculates the length and when it copies the data into kernel memory.
363 CVE-2006-0096 2006-01-06 2008-11-20
7.2
None Local Low Not required Complete Complete Complete
wan/sdla.c in Linux kernel 2.6.x before 2.6.11 and 2.4.x before 2.4.29 does not require the CAP_SYS_RAWIO privilege for an SDLA firmware upgrade, with unknown impact and local attack vectors. NOTE: further investigation suggests that this issue requires root privileges to exploit, since it is protected by CAP_NET_ADMIN; thus it might not be a vulnerability, although capabilities provide finer distinctions between privilege levels.
364 CVE-2006-0036 DoS Mem. Corr. 2006-01-23 2008-09-05
7.8
None Remote Low Not required None None Complete
ip_nat_pptp in the PPTP NAT helper (netfilter/ip_nat_helper_pptp.c) in Linux kernel 2.6.14, and other versions, allows remote attackers to cause a denial of service (memory corruption or crash) via an inbound PPTP_IN_CALL_REQUEST packet that causes a null pointer to be used in an offset calculation.
365 CVE-2005-4886 189 DoS 2010-02-26 2010-04-28
7.8
None Remote Low Not required None None Complete
The selinux_parse_skb_ipv6 function in security/selinux/hooks.c in the Linux kernel before 2.6.12-rc4 allows remote attackers to cause a denial of service (OOPS) via vectors associated with an incorrect call to the ipv6_skip_exthdr function.
366 CVE-2005-3858 DoS 2005-11-27 2016-10-17
7.8
None Remote Low Not required None None Complete
Memory leak in the ip6_input_finish function in ip6_input.c in Linux kernel 2.6.12 and earlier might allow attackers to cause a denial of service via malformed IPv6 packets with unspecified parameter problems, which prevents the SKB from being freed.
367 CVE-2005-3848 DoS 2005-11-26 2016-10-17
7.8
None Remote Low Not required None None Complete
Memory leak in the icmp_push_reply function in Linux 2.6 before 2.6.12.6 and 2.6.13 allows remote attackers to cause a denial of service (memory consumption) via a large number of crafted packets that cause the ip_append_data function to fail, aka "DST leak in icmp_push_reply."
368 CVE-2005-3810 DoS 2005-11-25 2016-10-17
7.8
None Remote Low Not required None None Complete
ip_conntrack_proto_icmp.c in ctnetlink in Linux kernel 2.6.14 up to 2.6.14.3 allows attackers to cause a denial of service (kernel oops) via a message without ICMP ID (ICMP_ID) information, which leads to a null dereference.
369 CVE-2005-3809 DoS 2005-11-25 2016-10-17
7.8
None Remote Low Not required None None Complete
The nfattr_to_tcp function in ip_conntrack_proto_tcp.c in ctnetlink in Linux kernel 2.6.14 up to 2.6.14.3 allows attackers to cause a denial of service (kernel oops) via an update message without private protocol information, which triggers a null dereference.
370 CVE-2005-3753 DoS 2005-11-22 2008-09-05
7.8
None Remote Low Not required None None Complete
Linux kernel before after 2.6.12 and before 2.6.13.1 might allow attackers to cause a denial of service (Oops) via certain IPSec packets that cause alignment problems in standard multi-block cipher processors. NOTE: it is not clear whether this issue can be triggered by an attacker.
371 CVE-2005-2500 DoS Exec Code Overflow 2005-08-08 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
Buffer overflow in the xdr_xcode_array2 function in xdr.c in Linux kernel 2.6.12, as used in SuSE Linux Enterprise Server 9, might allow remote attackers to cause a denial of service and possibly execute arbitrary code via crafted XDR data for the nfsacl protocol.
372 CVE-2005-1589 DoS Exec Code 2005-05-17 2017-02-19
7.2
Admin Local Low Not required Complete Complete Complete
The pkt_ioctl function in the pktcdvd block device ioctl handler (pktcdvd.c) in Linux kernel 2.6.12-rc4 and earlier calls the wrong function before passing an ioctl to the block device, which crosses security boundaries by making kernel address space accessible from user space and allows local users to cause a denial of service and possibly execute arbitrary code, a similar vulnerability to CVE-2005-1264.
373 CVE-2005-1264 2005-05-17 2016-10-17
7.2
Admin Local Low Not required Complete Complete Complete
Raw character devices (raw.c) in the Linux kernel 2.6.x call the wrong function before passing an ioctl to the block device, which crosses security boundaries by making kernel address space accessible from user space, a similar vulnerability to CVE-2005-1589.
374 CVE-2005-1263 Exec Code Overflow 2005-05-11 2010-08-21
7.2
Admin Local Low Not required Complete Complete Complete
The elf_core_dump function in binfmt_elf.c for Linux kernel 2.x.x to 2.2.27-rc2, 2.4.x to 2.4.31-pre1, and 2.6.x to 2.6.12-rc4 allows local users to execute arbitrary code via an ELF binary that, in certain conditions involving the create_elf_tables function, causes a negative length argument to pass a signed integer comparison, leading to a buffer overflow.
375 CVE-2005-0867 Overflow 2005-05-02 2010-08-21
7.2
Admin Local Low Not required Complete Complete Complete
Integer overflow in Linux kernel 2.6 allows local users to overwrite kernel memory by writing to a sysfs file.
376 CVE-2005-0839 +Priv 2005-05-02 2010-08-21
7.2
Admin Local Low Not required Complete Complete Complete
Linux kernel 2.6 before 2.6.11 does not restrict access to the N_MOUSE line discipline for a TTY, which allows local users to gain privileges by injecting mouse or keyboard events into other user sessions.
377 CVE-2005-0750 +Priv 2005-03-27 2016-10-17
7.2
Admin Local Low Not required Complete Complete Complete
The bluez_sock_create function in the Bluetooth stack for Linux kernel 2.4.6 through 2.4.30-rc1 and 2.6 through 2.6.11.5 allows local users to gain privileges via (1) socket or (2) socketpair call with a negative protocol value.
378 CVE-2005-0749 DoS 2005-04-01 2010-08-21
7.2
None Local Low Not required Complete Complete Complete
The load_elf_library in the Linux kernel before 2.6.11.6 allows local users to cause a denial of service (kernel crash) via a crafted ELF library or executable, which causes a free of an invalid pointer.
379 CVE-2005-0449 20 DoS Bypass 2005-05-02 2010-08-21
7.1
None Remote Medium Not required None None Complete
The netfilter/iptables module in Linux before 2.6.8.1 allows remote attackers to cause a denial of service (kernel crash) or bypass firewall rules via crafted packets, which are not properly handled by the skb_checksum_help function.
380 CVE-2005-0209 20 DoS 2005-05-02 2016-10-17
7.8
None Remote Low Not required None None Complete
Netfilter in Linux kernel 2.6.8.1 allows remote attackers to cause a denial of service (kernel crash) via crafted IP packet fragments.
381 CVE-2005-0177 119 DoS Overflow 2005-03-07 2016-10-17
7.8
None Remote Low Not required None None Complete
nls_ascii.c in Linux before 2.6.8.1 uses an incorrect table size, which allows attackers to cause a denial of service (kernel crash) via a buffer overflow.
382 CVE-2004-2536 +Priv 2004-12-31 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
The exit_thread function (process.c) in Linux kernel 2.6 through 2.6.5 does not invalidate the per-TSS io_bitmap pointers if a process obtains IO access permissions from the ioperm function but does not drop those permissions when it exits, which allows other processes to access the per-TSS pointers, access restricted memory locations, and possibly gain privileges.
383 CVE-2004-2013 Exec Code Overflow 2004-12-31 2016-10-17
7.2
Admin Local Low Not required Complete Complete Complete
Integer overflow in the SCTP_SOCKOPT_DEBUG_NAME SCTP socket option in socket.c in the Linux kernel 2.4.25 and earlier allows local users to execute arbitrary code via an optlen value of -1, which causes kmalloc to allocate 0 bytes of memory.
384 CVE-2004-1151 Overflow +Priv 2005-01-10 2016-10-17
7.2
Admin Local Low Not required Complete Complete Complete
Multiple buffer overflows in the (1) sys32_ni_syscall and (2) sys32_vm86_warning functions in sys_ia32.c for Linux 2.6.x may allow local attackers to modify kernel memory and gain privileges.
385 CVE-2004-1144 +Priv 2004-12-31 2016-10-17
7.2
Admin Local Low Not required Complete Complete Complete
Unknown vulnerability in the 32bit emulation code in Linux 2.4 on AMD64 systems allows local users to gain privileges.
386 CVE-2004-1072 DoS Exec Code Overflow 2005-01-10 2010-08-21
7.2
Admin Local Low Not required Complete Complete Complete
The binfmt_elf loader (binfmt_elf.c) in Linux kernel 2.4.x up to 2.4.27, and 2.6.x up to 2.6.8, may create an interpreter name string that is not NULL terminated, which could cause strings longer than PATH_MAX to be used, leading to buffer overflows that allow local users to cause a denial of service (hang) and possibly execute arbitrary code.
387 CVE-2004-1071 Exec Code 2005-01-10 2013-07-18
7.2
Admin Local Low Not required Complete Complete Complete
The binfmt_elf loader (binfmt_elf.c) in Linux kernel 2.4.x up to 2.4.27, and 2.6.x up to 2.6.8, does not properly handle a failed call to the mmap function, which causes an incorrect mapped image and may allow local users to execute arbitrary code.
388 CVE-2004-1070 Exec Code 2005-01-10 2010-08-21
7.2
Admin Local Low Not required Complete Complete Complete
The load_elf_binary function in the binfmt_elf loader (binfmt_elf.c) in Linux kernel 2.4.x up to 2.4.27, and 2.6.x up to 2.6.8, does not properly check return values from calls to the kernel_read function, which may allow local users to modify sensitive memory in a setuid program and execute arbitrary code.
389 CVE-2004-1057 DoS 2005-01-21 2010-08-21
7.2
None Local Low Not required Complete Complete Complete
Multiple drivers in Linux kernel 2.4.19 and earlier do not properly mark memory with the VM_IO flag, which causes incorrect reference counts and may lead to a denial of service (kernel panic) when accessing freed kernel pages.
390 CVE-2004-0986 2005-03-01 2016-12-07
7.5
User Remote Low Not required Partial Partial Partial
Iptables before 1.2.11, under certain conditions, does not properly load the required modules at system startup, which causes the firewall rules to fail to load and protect the system from remote attackers.
391 CVE-2004-0887 +Priv 2005-01-27 2008-09-10
7.2
Admin Local Low Not required Complete Complete Complete
SUSE Linux Enterprise Server 9 on the S/390 platform does not properly handle a certain privileged instruction, which allows local users to gain root privileges.
392 CVE-2004-0658 DoS Exec Code Overflow 2004-08-06 2016-10-17
7.2
Admin Local Low Not required Complete Complete Complete
Integer overflow in the hpsb_alloc_packet function (incorrectly reported as alloc_hpsb_packet) in IEEE 1394 (Firewire) driver 2.4 and 2.6 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via the functions (1) raw1394_write, (2) state_connected, (3) handle_remote_request, or (4) hpsb_make_writebpacket.
393 CVE-2004-0496 +Priv 2004-12-06 2008-09-10
7.2
Admin Local Low Not required Complete Complete Complete
Multiple unknown vulnerabilities in Linux kernel 2.6 allow local users to gain privileges or access kernel memory, a different set of vulnerabilities than those identified in CVE-2004-0495, as found by the Sparse source code checking tool.
394 CVE-2004-0495 +Priv 2004-08-06 2010-08-21
7.2
Admin Local Low Not required Complete Complete Complete
Multiple unknown vulnerabilities in Linux kernel 2.4 and 2.6 allow local users to gain privileges or access kernel memory, as found by the Sparse source code checking tool.
395 CVE-2004-0447 DoS 2004-08-06 2010-08-21
7.2
None Local Low Not required Complete Complete Complete
Unknown vulnerability in Linux before 2.4.26 for IA64 allows local users to cause a denial of service, with unknown impact. NOTE: due to a typo, this issue was accidentally assigned CVE-2004-0477. This is the proper candidate to use for the Linux local DoS.
396 CVE-2004-0424 DoS Exec Code Overflow 2004-07-07 2016-10-17
7.2
Admin Local Low Not required Complete Complete Complete
Integer overflow in the ip_setsockopt function in Linux kernel 2.4.22 through 2.4.25 and 2.6.1 through 2.6.3 allows local users to cause a denial of service (crash) or execute arbitrary code via the MCAST_MSFILTER socket option.
397 CVE-2004-0228 +Priv 2004-08-18 2008-09-10
7.2
Admin Local Low Not required Complete Complete Complete
Integer signedness error in the cpufreq proc handler (cpufreq_procctl) in Linux kernel 2.6 allows local users to gain privileges.
398 CVE-2004-0186 +Priv 2004-03-15 2016-10-17
7.2
Admin Local Low Not required Complete Complete Complete
smbmnt in Samba 2.x and 3.x on Linux 2.6, when installed setuid, allows local users to gain root privileges by mounting a Samba share that contains a setuid root program, whose setuid attributes are not cleared when the share is mounted.
399 CVE-2004-0077 +Priv 2004-03-03 2016-10-17
7.2
Admin Local Low Not required Complete Complete Complete
The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not properly check the return value from the do_munmap function when the maximum number of VMA descriptors is exceeded, which allows local users to gain root privileges, a different vulnerability than CAN-2003-0985.
400 CVE-2004-0010 Overflow +Priv 2004-03-03 2010-08-21
7.2
Admin Local Low Not required Complete Complete Complete
Stack-based buffer overflow in the ncp_lookup function for ncpfs in Linux kernel 2.4.x allows local users to gain privileges.
Total number of vulnerabilities : 421   Page : 1 2 3 4 5 6 7 8 (This Page)9
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.